Skip to content

Commit 30156e7

Browse files
dandclarkmfreed7
dandclark
authored and
mfreed7
committed
Prevent type: "javascript" import asessions
This was the original intent of the import assertions integration, but type: "javascript" was unintentionally allowed to work due to a bug involving the spec's internal use of the "javascript" module type for JavaScript module scripts. Fixes whatwg#7342.
1 parent aebf3bb commit 30156e7

File tree

1 file changed

+99
-70
lines changed

1 file changed

+99
-70
lines changed

‎source‎

Lines changed: 99 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -91370,14 +91370,12 @@ document.querySelector("button").addEventListener("click", bound);
9137091370
we only asked for "<code data-x="">type</code>" assertions in
9137191371
<span>HostGetSupportedImportAssertions</span>.</p></li>
9137291372

91373-
<li><p>If <var>moduleRequest</var>.[[Assertions]] has a <span>Record</span> <var>entry</var>
91374-
such that <var>entry</var>.[[Key]] is "<code data-x="">type</code>", then let <var>module
91375-
type</var> be <var>entry</var>.[[Value]]. Otherwise let <var>module type</var> be "<code
91376-
data-x="">javascript</code>".</p></li>
91373+
<li><p>Let <var>moduleType</var> be the result of running the <span>module type from module
91374+
request</span> steps given <var>moduleRequest</var>.</p></li>
9137791375

91378-
<li><p>If the result of running the <span>module type allowed</span> steps given <var>module
91379-
type</var> and <var>settings object</var> is false, then asynchronously complete this algorithm
91380-
with null, and return.</p></li>
91376+
<li><p>If the result of running the <span>module type allowed</span> steps given
91377+
<var>moduleType</var> and <var>settings object</var> is false, then asynchronously complete this
91378+
algorithm with null, and return.</p></li>
9138191379

9138291380
<li><p><span>Fetch a single module script</span> given <var>url</var>, <var>settings
9138391381
object</var>, "<code data-x="">script</code>", <var>options</var>, <var>settings object</var>,
@@ -91389,7 +91387,7 @@ document.querySelector("button").addEventListener("click", bound);
9138991387
<li><p>If <var>result</var> is null, asynchronously complete this algorithm with null, and
9139091388
return.</p></li>
9139191389

91392-
<li><p>Let <var>visited set</var> be « (<var>url</var>, <var>module type</var>) ».</p></li>
91390+
<li><p>Let <var>visited set</var> be « (<var>url</var>, <var>moduleType</var>) ».</p></li>
9139391391

9139491392
<li><p><span data-x="fetch the descendants of and link a module script">Fetch the
9139591393
descendants of and link</span> <var>result</var> given <var>settings object</var>,
@@ -91737,20 +91735,18 @@ document.querySelector("button").addEventListener("click", bound);
9173791735
href="#validate-requested-module-specifiers">previously successful</a> with these same two
9173891736
arguments.</p></li>
9173991737

91740-
<li><p>If <var>requested</var>.[[Assertions]] has a <span>Record</span> <var>entry</var> such
91741-
that <var>entry</var>.[[Key]] is "<code data-x="">type</code>", then let <var>module type</var>
91742-
be <var>entry</var>.[[Value]]. Otherwise let <var>module type</var> be "<code
91743-
data-x="">javascript</code>".</p></li>
91738+
<li><p>Let <var>moduleType</var> be the result of running the <span>module type from module
91739+
request</span> steps given <var>requested</var>.</p></li>
9174491740

9174591741
<li>
9174691742
<p>If <var>visited set</var> does not <span data-x="list contains">contain</span>
91747-
(<var>url</var>, <var>module type</var>), then:</p>
91743+
(<var>url</var>, <var>moduleType</var>), then:</p>
9174891744

9174991745
<ol>
9175091746
<li><p><span data-x="list append">Append</span> <var>requested</var> to
9175191747
<var>moduleRequests</var>.</p></li>
9175291748

91753-
<li><p><span data-x="set append">Append</span> (<var>url</var>, <var>module type</var>) to
91749+
<li><p><span data-x="set append">Append</span> (<var>url</var>, <var>moduleType</var>) to
9175491750
<var>visited set</var>.</p></li>
9175591751
</ol>
9175691752
</li>
@@ -91803,13 +91799,11 @@ document.querySelector("button").addEventListener("click", bound);
9180391799
href="#validate-requested-module-specifiers">previously successful</a> with these same two
9180491800
arguments.</p></li>
9180591801

91806-
<li><p>If <var>moduleRequest</var>.[[Assertions]] has a <span>Record</span> <var>entry</var>
91807-
such that <var>entry</var>.[[Key]] is "<code data-x="">type</code>", then let <var>module
91808-
type</var> be <var>entry</var>.[[Value]]. Otherwise let <var>module type</var> be "<code
91809-
data-x="">javascript</code>".</p></li>
91802+
<li><p>Let <var>moduleType</var> be the result of running the <span>module type from module
91803+
request</span> steps given <var>moduleRequest</var>.</p></li>
9181091804

9181191805
<li><p>Assert: <var>visited set</var> <span data-x="list contains">contains</span>
91812-
(<var>url</var>, <var>module type</var>).</p></li>
91806+
(<var>url</var>, <var>moduleType</var>).</p></li>
9181391807

9181491808
<li><p><span>Fetch a single module script</span> given <var>url</var>, <var>fetch client settings
9181591809
object</var>, <var>destination</var>, <var>options</var>, <var>module map settings object</var>,
@@ -91840,41 +91834,33 @@ document.querySelector("button").addEventListener("click", bound);
9184091834
complete with either null (on failure) or a <span>module script</span> (on success).</p>
9184191835

9184291836
<ol>
91843-
<li><p>Let <var>module type</var> be "<code data-x="">javascript</code>".</p></li>
91837+
<li><p>Let <var>moduleType</var> be "<code data-x="">javascript</code>".</p></li>
9184491838

91845-
<li>
91846-
<p>If <var>moduleRequest</var> was given and <var>moduleRequest</var>.[[Assertions]] has a
91847-
<span>Record</span> <var>entry</var> such that <var>entry</var>.[[Key]] is "<code
91848-
data-x="">type</code>", then:</p>
91849-
91850-
<ol>
91851-
<li><p>Assert: No more than one such <span>Record</span> exists.</p></li>
91839+
<li><p>If <var>moduleRequest</var> was given, then set <var>moduleType</var> to the result of
91840+
running the <span>module type from module request</span> steps given
91841+
<var>moduleRequest</var>.</p></li>
9185291842

91853-
<li><p>Set <var>module type</var> to <var>entry</var>.[[Value]].</p></li>
91854-
</ol>
91855-
</li>
91856-
91857-
<li><p>Assert: the result of running the <span>module type allowed</span> steps given <var>module
91858-
type</var> and <var>module map settings object</var> is true. Otherwise we would not have reached
91859-
this point because a failure would have been raised when inspecting
91843+
<li><p>Assert: the result of running the <span>module type allowed</span> steps given
91844+
<var>moduleType</var> and <var>module map settings object</var> is true. Otherwise we would not
91845+
have reached this point because a failure would have been raised when inspecting
9186091846
<var>moduleRequest</var>.[[Assertions]] in <a
9186191847
href="#validate-requested-module-specifiers">create a JavaScript module script</a> or
9186291848
<span>fetch an import() module script graph</span>.</p></li>
9186391849

9186491850
<li><p>Let <var>moduleMap</var> be <var>module map settings object</var>'s <span
9186591851
data-x="concept-settings-object-module-map">module map</span>.</p></li>
9186691852

91867-
<li><p>If <var>moduleMap</var>[(<var>url</var>, <var>module type</var>)] is
91853+
<li><p>If <var>moduleMap</var>[(<var>url</var>, <var>moduleType</var>)] is
9186891854
"<code data-x="">fetching</code>", wait <span>in parallel</span> until that entry's value
9186991855
changes, then <span>queue a task</span> on the <span>networking task source</span> to proceed
9187091856
with running the following steps.</p></li>
9187191857

91872-
<li><p>If <var>moduleMap</var>[(<var>url</var>, <var>module type</var>)] <span
91858+
<li><p>If <var>moduleMap</var>[(<var>url</var>, <var>moduleType</var>)] <span
9187391859
data-x="map exists">exists</span>, asynchronously complete this algorithm with
91874-
<var>moduleMap</var>[<var>url</var> / <var>module type</var>], and return.</p></li>
91860+
<var>moduleMap</var>[<var>url</var> / <var>moduleType</var>], and return.</p></li>
9187591861

91876-
<li><p><span data-x="map set">Set</span> <var>moduleMap</var>[(<var>url</var>, <var>module
91877-
type</var>)] to "<code data-x="">fetching</code>".</p></li>
91862+
<li><p><span data-x="map set">Set</span> <var>moduleMap</var>[(<var>url</var>,
91863+
<var>moduleType</var>)] to "<code data-x="">fetching</code>".</p></li>
9187891864

9187991865
<li><p>Let <var>request</var> be a new <span data-x="concept-request">request</span> whose
9188091866
<span data-x="concept-request-url">URL</span> is <var>url</var>, <span
@@ -91924,8 +91910,9 @@ document.querySelector("button").addEventListener("click", bound);
9192491910
<span>ok status</span>.</p></li>
9192591911
</ul>
9192691912

91927-
<p>then <span data-x="map set">set</span> <var>moduleMap</var>[(<var>url</var>, <var>module
91928-
type</var>)] to null, asynchronously complete this algorithm with null, and return.</p>
91913+
<p>then <span data-x="map set">set</span> <var>moduleMap</var>[(<var>url</var>,
91914+
<var>moduleType</var>)] to null, asynchronously complete this algorithm with null, and
91915+
return.</p>
9192991916
</li>
9193091917

9193191918
<li><p>Let <var>source text</var> be the result of <span data-x="UTF-8 decode">UTF-8
@@ -91937,26 +91924,26 @@ document.querySelector("button").addEventListener("click", bound);
9193791924

9193891925
<li><p>Let <var>module script</var> be null.</p></li>
9193991926

91940-
<li><p>If <var>MIME type</var> is a <span>JavaScript MIME type</span> and <var>module type</var>
91927+
<li><p>If <var>MIME type</var> is a <span>JavaScript MIME type</span> and <var>moduleType</var>
9194191928
is "<code data-x="">javascript</code>", then set <var>module script</var> to the result of
9194291929
<span>creating a JavaScript module script</span> given <var>source text</var>, <var>module map
9194391930
settings object</var>, <var>response</var>'s <span data-x="concept-response-url">url</span>, and
9194491931
<var>options</var>.</p></li>
9194591932

9194691933
<li><p>If the <span>MIME type essence</span> of <var>MIME type</var> is "<code>text/css</code>"
91947-
and <var>module type</var> is "<code data-x="">css</code>", then set <var>module script</var> to
91934+
and <var>moduleType</var> is "<code data-x="">css</code>", then set <var>module script</var> to
9194891935
the result of <span>creating a CSS module script</span> given <var>source text</var> and
9194991936
<var>module map settings object</var>.</p></li>
9195091937

91951-
<li><p>If <var>MIME type essence</var> is a <span>JSON MIME type</span> and <var>module
91952-
type</var> is "<code data-x="">json</code>", then set <var>module script</var> to the result of
91938+
<li><p>If <var>MIME type essence</var> is a <span>JSON MIME type</span> and <var>moduleType</var>
91939+
is "<code data-x="">json</code>", then set <var>module script</var> to the result of
9195391940
<span>creating a JSON module script</span> given <var>source text</var> and <var>module map
9195491941
settings object</var>.</p></li>
9195591942

9195691943
<li>
91957-
<p><span data-x="map set">Set</span> <var>moduleMap</var>[(<var>url</var>, <var>module
91958-
type</var>)] to <var>module script</var>, and asynchronously complete this algorithm with
91959-
<var>module script</var>.</p>
91944+
<p><span data-x="map set">Set</span> <var>moduleMap</var>[(<var>url</var>,
91945+
<var>moduleType</var>)] to <var>module script</var>, and asynchronously complete this algorithm
91946+
with <var>module script</var>.</p>
9196091947

9196191948
<p class="note">It is intentional that the <span>module map</span> is keyed by the <span
9196291949
data-x="concept-request-url">request URL</span>, whereas the <span
@@ -92000,13 +91987,11 @@ document.querySelector("button").addEventListener("click", bound);
9200091987
href="#validate-requested-module-specifiers">marked as itself having a parse
9200191988
error</a>.)</p></li>
9200291989

92003-
<li><p>If <var>moduleRequest</var>.[[Assertions]] has a <span>Record</span> <var>entry</var>
92004-
such that <var>entry</var>.[[Key]] is "<code data-x="">type</code>", then let <var>module
92005-
type</var> be <var>entry</var>.[[Value]]. Otherwise let <var>module type</var> be "<code
92006-
data-x="">javascript</code>".</p></li>
91990+
<li><p>Let <var>moduleType</var> be the result of running the <span>module type from module
91991+
request</span> steps given <var>moduleRequest</var>.</p></li>
9200791992

92008-
<li><p>Let <var>childModule</var> be <var>moduleMap</var>[(<var>childURL</var>, <var>module
92009-
type</var>)].</p></li>
91993+
<li><p>Let <var>childModule</var> be <var>moduleMap</var>[(<var>childURL</var>,
91994+
<var>moduleType</var>)].</p></li>
9201091995

9201191996
<li><p>Assert: <var>childModule</var> is a <span>module script</span> (i.e., it is not "<code
9201291997
data-x="">fetching</code>" or null); by now all <span data-x="module script">module
@@ -92149,14 +92134,12 @@ document.querySelector("button").addEventListener("click", bound);
9214992134
a module specifier</span> given <var>script</var>'s <span data-x="concept-script-base-url">base
9215092135
URL</span> and <var>requested</var>.[[Specifier]].</p></li>
9215192136

92152-
<li><p>If <var>requested</var>.[[Assertions]] has a <span>Record</span> <var>entry</var> such
92153-
that <var>entry</var>.[[Key]] is "<code data-x="">type</code>", then let <var>module type</var>
92154-
be <var>entry</var>.[[Value]]. Otherwise let <var>module type</var> be "<code
92155-
data-x="">javascript</code>".</p></li>
92137+
<li><p>Let <var>moduleType</var> be the result of running the <span>module type from module
92138+
request</span> steps given <var>requested</var>.</p></li>
9215692139

9215792140
<li>
9215892141
<p>If <var>url</var> is failure, or if the result of running the <span>module type
92159-
allowed</span> steps given <var>module type</var> and <var>settings</var> is false, then:</p>
92142+
allowed</span> steps given <var>moduleType</var> and <var>settings</var> is false, then:</p>
9216092143
<ol>
9216192144
<li><p>Let <var>error</var> be a new <code>TypeError</code> exception.</p></li>
9216292145

@@ -92248,16 +92231,45 @@ document.querySelector("button").addEventListener("click", bound);
9224892231
<li><p>Return <var>script</var>.</p></li>
9224992232
</ol>
9225092233

92251-
<p>The <dfn>module type allowed</dfn> steps, given a <span>string</span> <var>module type</var>
92234+
<p>The <dfn>module type from module request</dfn> steps, given a <span>ModuleRequest
92235+
Record</span> <var>moduleRequest</var>, are as follows:</p>
92236+
92237+
<ol>
92238+
<li><p>Let <var>moduleType</var> be "<code data-x="">javascript</code>".</p></li>
92239+
92240+
<li>
92241+
<p>If <var>moduleRequest</var>.[[Assertions]] has a <span>Record</span> <var>entry</var> such
92242+
that <var>entry</var>.[[Key]] is "<code data-x="">type</code>", then:</p>
92243+
92244+
<ol>
92245+
<li>
92246+
<p>If <var>entry</var>.[[Value]] is "<code data-x="">javascript</code>", then set
92247+
<var>moduleType</var> to null.</p>
92248+
92249+
<p class="note">This specification uses the "<code data-x="">javascript</code>" module type
92250+
internally for <span data-x="JavaScript module script">JavaScript module scripts</span>, so
92251+
this step is needed to prevent modules from being imported using a "<code
92252+
data-x="">javascript</code>" type assertion (a null <var>moduleType</var> will cause the
92253+
<span>module type allowed</span> check to fail).</p>
92254+
</li>
92255+
92256+
<li><p>Otherwise, set <var>moduleType</var> to <var>entry</var>.[[Value]].</p></li>
92257+
</ol>
92258+
</li>
92259+
92260+
<li><p>Return <var>moduleType</var>.</p></li>
92261+
</ol>
92262+
92263+
<p>The <dfn>module type allowed</dfn> steps, given a <span>string</span> <var>moduleType</var>
9225292264
and an <span>environment settings object</span> <var>settings</var>, are as follows:</p>
9225392265

9225492266
<ol>
92255-
<li><p>If <var>module type</var> is not "<code data-x="">javascript</code>", "<code
92267+
<li><p>If <var>moduleType</var> is not "<code data-x="">javascript</code>", "<code
9225692268
data-x="">css</code>", or "<code data-x="">json</code>", then return false.</p></li>
9225792269

92258-
<li><p>If <var>module type</var> is "<code data-x="">css</code>" and the
92270+
<li><p>If <var>moduleType</var> is "<code data-x="">css</code>" and the
9225992271
<code>CSSStyleSheet</code> interface is not <span data-x="idl-exposed">exposed</span> in
92260-
<var>setting</var>'s <span data-x="environment settings object's Realm">Realm</span>, then
92272+
<var>settings</var>'s <span data-x="environment settings object's Realm">Realm</span>, then
9226192273
return false.</p></li>
9226292274

9226392275
<li><p>Return true.</p></li>
@@ -93160,6 +93172,25 @@ import "https://example.com/foo/../module2.mjs";</code></pre>
9316093172
the correct type from succeeding.</p>
9316193173
</div>
9316293174

93175+
<div class="example">
93176+
<p>JavaScript module scripts are the default import type when importing from another JavaScript
93177+
module; that is, when an <code data-x="">import</code> statement lacks a <code
93178+
data-x="">type</code> import assertion the imported module script's type will be JavaScript.
93179+
Attempting to import a JavaScript resource using an <code data-x="">import</code> statement with
93180+
a <code data-x="">type</code> import assertion will fail:</p>
93181+
93182+
<pre><code class="html">&lt;script type="module">
93183+
// All of the following will fail, assuming that the imported .mjs files are served with a
93184+
// JavaScript MIME type. JavaScript module scripts are the default and cannot be imported with
93185+
// any import type assertion.
93186+
import foo from "./foo.mjs" assert { type: "javascript" };
93187+
import foo2 from "./foo2.mjs" assert { type: "js" };
93188+
import foo3 from "./foo3.mjs" assert { type: "" };
93189+
await import("./foo4.mjs", { assert: { type: null } });
93190+
await import("./foo5.mjs", { assert: { type: undefined } });
93191+
&lt;/script></code></pre>
93192+
</div>
93193+
9316393194
<div w-nodev>
9316493195

9316593196
<p>To <dfn>resolve a module specifier</dfn> given a <span>URL</span> <var>base URL</var> and a
@@ -93397,14 +93428,12 @@ import "https://example.com/foo/../module2.mjs";</code></pre>
9339793428
same two arguments (either <a href="#validate-requested-module-specifiers">while creating the
9339893429
corresponding module script</a>, or in <span>fetch an import() module script graph</span>).</p></li>
9339993430

93400-
<li><p>If <var>moduleRequest</var>.[[Assertions]] has a <span>Record</span> <var>entry</var> such
93401-
that <var>entry</var>.[[Key]] is "<code data-x="">type</code>", then let <var>module type</var>
93402-
be <var>entry</var>.[[Value]]. Otherwise let <var>module type</var> be "<code
93403-
data-x="">javascript</code>".</p></li>
93431+
<li><p>Let <var>moduleType</var> be the result of running the <span>module type from module
93432+
request</span> steps given <var>moduleRequest</var>.</p></li>
9340493433

93405-
<li><p>Let <var>resolved module script</var> be <var>moduleMap</var>[(<var>url</var>, <var>module
93406-
type</var>)]. (This entry must <span data-x="map exists">exist</span> for us to have gotten to
93407-
this point.)</p></li>
93434+
<li><p>Let <var>resolved module script</var> be <var>moduleMap</var>[(<var>url</var>,
93435+
<var>moduleType</var>)]. (This entry must <span data-x="map exists">exist</span> for us to have
93436+
gotten to this point.)</p></li>
9340893437

9340993438
<li><p>Assert: <var>resolved module script</var> is a <span>module script</span> (i.e., is not
9341093439
null or "<code data-x="">fetching</code>").</p></li>

0 commit comments

Comments
 (0)